Garante per la protezione dei dati personali (Italy) - 551/2026
Italian DPA fines Bologna University Hospital €10,000 for unlawful personal data publication.
The Italian Data Protection Authority (Garante) fined Bologna University Hospital IRCCS €10,000 for violating GDPR articles 5, 6, and 9. The hospital published personal data of ineligible candidates on its website for five years, which the DPA deemed unlawful as it could infer sensitive data and lacked a proper legal basis. The hospital has since removed the data and implemented preventative measures.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonBologna University Hospital IRCCS published personal data of ineligible job candidates on its public website without a lawful basis, exposing sensitive information for five years before removal. The core failure was the absence of a proper legal justification under GDPR Articles 5, 6, and 9 for processing and publicly disclosing data that could infer special category (sensitive) information. This case highlights how data minimisation and purpose limitation principles are routinely overlooked when publishing administrative or HR-related documents online. The five-year exposure window also indicates a lack of periodic data audits and lifecycle management processes. Even inadvertent or administrative disclosures can constitute serious GDPR violations carrying financial and reputational consequences.